Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve auth framework with authenticator type. #5854

Open
wants to merge 3 commits into
base: authentication-extension
Choose a base branch
from

Conversation

Thisara-Welmilla
Copy link
Contributor

@Thisara-Welmilla Thisara-Welmilla commented Aug 12, 2024

Task issue:

With above feature, we will introduce an authentication adapter that extends the AbstractApplicationAuthenticator and implements the FederatedApplicationAuthenticator class. This adapter will support to authenticated both LOCAL and FEDERATED users and user type will be defined at runtime. The authentication flow will need to accommodate both types. To achieve this, the following improvements will introduced with this PR:

  1. Introduced new authenticator types (LOCAL, FEDERATED, REQUEST_PATH, FLOW_HANDLER, CUSTOM, UNDEFINED).
  2. Introduce new method, getAuthenticatorType() to the ApplicationAuthenticator interface, with UNDEFINED as the default return value.
  3. The authenticator interfaces that extend ApplicationAuthenticator will override the getAuthenticatorType() method to return their specific authenticator type.
  4. The some authentication flows logic differs based on the instanceof FederatedApplicationAuthenticator check, which ideally should be based on the authenticated user (isFedUser()) of the corresponding step. Those will be replaced with AuthenticatorType.FEDERATED.equals(authenticator.getAuthenticatorType()) to support the existing behavior.
  5. To handle user type for the custom authentication adapter at above(4) places, the following check will be added: (AuthenticatorType.CUSTOM.equals(authenticator.getAuthenticatorType()) && stepConfig.getAuthenticatedUser().isFederatedUser()).

jenkins-is-staging

This comment was marked as outdated.

@Thisara-Welmilla Thisara-Welmilla force-pushed the improve-auth-framework branch 5 times, most recently from 7311b5c to c54c2a7 Compare August 18, 2024 18:23
@jenkins-is-staging

This comment was marked as outdated.

@jenkins-is-staging

This comment was marked as outdated.

jenkins-is-staging

This comment was marked as outdated.

@Thisara-Welmilla Thisara-Welmilla force-pushed the improve-auth-framework branch 3 times, most recently from 31bbc5c to 5417c4a Compare August 20, 2024 17:37
Comment on lines +27 to +31
default AuthenticatorType getAuthenticatorType() {

return AuthenticatorType.FLOW_HANDLER;
}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this needed ?
Does this authenticator get returned back in authenticator API ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No this authenticator get returned back in authenticator API. But as we are overriding this method in all other marker interface, though of adding for this also.

If this is unnecessary will remove this.

@@ -713,7 +713,8 @@ protected void doAuthentication(HttpServletRequest request, HttpServletResponse
}

String idpName = FrameworkConstants.LOCAL_IDP_NAME;
if (context.getExternalIdP() != null && authenticator instanceof FederatedApplicationAuthenticator) {
if (context.getExternalIdP() != null && (AuthenticatorType.FEDERATED.equals(authenticator
.getAuthenticatorType()) || AuthenticatorType.CUSTOM.equals(authenticator.getAuthenticatorType()))) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't we need to check for the user here ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At this point, the authentication have not happened yet, therefore, cannot check user type. Also this check is just to decide, what should be goes to diagnostic log; whether LOCAL and specific idp name based on the authenticator Type (as local authenticators does not have associated IDP).

@wso2 wso2 deleted a comment from jenkins-is-staging Aug 22, 2024
@Thisara-Welmilla Thisara-Welmilla changed the base branch from master to authentication-extension August 27, 2024 15:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants